constants.js 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. 'use strict'
  2. const corsSafeListedMethods = /** @type {const} */ (['GET', 'HEAD', 'POST'])
  3. const corsSafeListedMethodsSet = new Set(corsSafeListedMethods)
  4. const nullBodyStatus = /** @type {const} */ ([101, 204, 205, 304])
  5. const redirectStatus = /** @type {const} */ ([301, 302, 303, 307, 308])
  6. const redirectStatusSet = new Set(redirectStatus)
  7. /**
  8. * @see https://fetch.spec.whatwg.org/#block-bad-port
  9. */
  10. const badPorts = /** @type {const} */ ([
  11. '1', '7', '9', '11', '13', '15', '17', '19', '20', '21', '22', '23', '25', '37', '42', '43', '53', '69', '77', '79',
  12. '87', '95', '101', '102', '103', '104', '109', '110', '111', '113', '115', '117', '119', '123', '135', '137',
  13. '139', '143', '161', '179', '389', '427', '465', '512', '513', '514', '515', '526', '530', '531', '532',
  14. '540', '548', '554', '556', '563', '587', '601', '636', '989', '990', '993', '995', '1719', '1720', '1723',
  15. '2049', '3659', '4045', '4190', '5060', '5061', '6000', '6566', '6665', '6666', '6667', '6668', '6669', '6679',
  16. '6697', '10080'
  17. ])
  18. const badPortsSet = new Set(badPorts)
  19. /**
  20. * @see https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-header
  21. */
  22. const referrerPolicyTokens = /** @type {const} */ ([
  23. 'no-referrer',
  24. 'no-referrer-when-downgrade',
  25. 'same-origin',
  26. 'origin',
  27. 'strict-origin',
  28. 'origin-when-cross-origin',
  29. 'strict-origin-when-cross-origin',
  30. 'unsafe-url'
  31. ])
  32. /**
  33. * @see https://w3c.github.io/webappsec-referrer-policy/#referrer-policies
  34. */
  35. const referrerPolicy = /** @type {const} */ ([
  36. '',
  37. ...referrerPolicyTokens
  38. ])
  39. const referrerPolicyTokensSet = new Set(referrerPolicyTokens)
  40. const requestRedirect = /** @type {const} */ (['follow', 'manual', 'error'])
  41. const safeMethods = /** @type {const} */ (['GET', 'HEAD', 'OPTIONS', 'TRACE'])
  42. const safeMethodsSet = new Set(safeMethods)
  43. const requestMode = /** @type {const} */ (['navigate', 'same-origin', 'no-cors', 'cors'])
  44. const requestCredentials = /** @type {const} */ (['omit', 'same-origin', 'include'])
  45. const requestCache = /** @type {const} */ ([
  46. 'default',
  47. 'no-store',
  48. 'reload',
  49. 'no-cache',
  50. 'force-cache',
  51. 'only-if-cached'
  52. ])
  53. /**
  54. * @see https://fetch.spec.whatwg.org/#request-body-header-name
  55. */
  56. const requestBodyHeader = /** @type {const} */ ([
  57. 'content-encoding',
  58. 'content-language',
  59. 'content-location',
  60. 'content-type',
  61. // See https://github.com/nodejs/undici/issues/2021
  62. // 'Content-Length' is a forbidden header name, which is typically
  63. // removed in the Headers implementation. However, undici doesn't
  64. // filter out headers, so we add it here.
  65. 'content-length'
  66. ])
  67. /**
  68. * @see https://fetch.spec.whatwg.org/#enumdef-requestduplex
  69. */
  70. const requestDuplex = /** @type {const} */ ([
  71. 'half'
  72. ])
  73. /**
  74. * @see http://fetch.spec.whatwg.org/#forbidden-method
  75. */
  76. const forbiddenMethods = /** @type {const} */ (['CONNECT', 'TRACE', 'TRACK'])
  77. const forbiddenMethodsSet = new Set(forbiddenMethods)
  78. const subresource = /** @type {const} */ ([
  79. 'audio',
  80. 'audioworklet',
  81. 'font',
  82. 'image',
  83. 'manifest',
  84. 'paintworklet',
  85. 'script',
  86. 'style',
  87. 'track',
  88. 'video',
  89. 'xslt',
  90. ''
  91. ])
  92. const subresourceSet = new Set(subresource)
  93. module.exports = {
  94. subresource,
  95. forbiddenMethods,
  96. requestBodyHeader,
  97. referrerPolicy,
  98. requestRedirect,
  99. requestMode,
  100. requestCredentials,
  101. requestCache,
  102. redirectStatus,
  103. corsSafeListedMethods,
  104. nullBodyStatus,
  105. safeMethods,
  106. badPorts,
  107. requestDuplex,
  108. subresourceSet,
  109. badPortsSet,
  110. redirectStatusSet,
  111. corsSafeListedMethodsSet,
  112. safeMethodsSet,
  113. forbiddenMethodsSet,
  114. referrerPolicyTokens: referrerPolicyTokensSet
  115. }